tfstateファイルから読み解くTerraformリソース依存順序｜計画どおり壊せる削除設計

この記事のポイント

・tfstateファイルのdependencies配列がリソース削除順序を決定する
・terraform show -jsonで依存関係をJSON形式で完全可視化できる
・lifecycle.prevent_destroyとdepends_onで削除設計を宣言的に制御できる
・stateロック発生時はterraform force-unlockで即座に解除できる

# terraform.tfstate（抜粋）
{
  "version": 4,
  "terraform_version": "1.8.5",
  "serial": 12,
  "resources": [
    {
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "instances": [
        {
          "attributes": {
            "id": "i-0a1b2c3d4e5f67890",
            "instance_type": "t3.micro"
          },
          "dependencies": [
            "aws_security_group.web_sg",
            "aws_subnet.public",
            "module.vpc.aws_vpc.main"
          ]
        }
      ]
    }
  ]
}

# jqで各リソースのアドレスと依存関係を一覧表示
# terraform show -json | jq ".values.root_module.resources[] | {address: .address, deps: .depends_on}"

{
  "address": "aws_instance.web",
  "deps": [
    "aws_security_group.web_sg",
    "aws_subnet.public"
  ]
}
{
  "address": "aws_security_group.web_sg",
  "deps": []
}
{
  "address": "aws_subnet.public",
  "deps": [
    "module.vpc.aws_vpc.main"
  ]
}

# terraform show -json | python3 -m json.tool | grep -A 10 "depends_on"

# destroyフェーズの依存グラフをDOT形式で出力
# terraform graph -type=plan-destroy > destroy_graph.dot

# Graphvizをインストールしてからsvgに変換（Ubuntu/Debianの場合）
# apt-get install graphviz
# dot -Tsvg destroy_graph.dot -o destroy_graph.svg

# planファイルを作成してからgraphを生成（より正確なグラフ）
# terraform plan -out=tfplan
# terraform graph -plan=tfplan -type=plan-destroy

resource "aws_instance" "web" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t3.micro"

  # セキュリティグループのIDを参照 → tfstateのdependenciesに自動記録される
  vpc_security_group_ids = [aws_security_group.web_sg.id]
}

resource "aws_lambda_function" "processor" {
  filename      = "lambda.zip"
  function_name = "data-processor"
  role          = aws_iam_role.lambda_exec.arn
  handler       = "index.handler"
  runtime       = "python3.12"

  # IAMポリシーの伝播を待ってから関数を作成する
  depends_on = [aws_iam_role_policy_attachment.lambda_policy]
}

resource "aws_db_instance" "main" {
  identifier        = "prod-mysql"
  instance_class    = "db.t3.small"
  allocated_storage = 20
  engine            = "mysql"
  engine_version    = "8.0"

  lifecycle {
    prevent_destroy = true
  }
}

# terraform plan実行時の出力（削除が発生するケース）
│ Error: Instance cannot be destroyed
│
│   on main.tf line 12, in resource "aws_db_instance" "main":
│   12:     prevent_destroy = true
│
│ Resource aws_db_instance.main has lifecycle.prevent_destroy set,
│ but the plan calls for this resource to be destroyed. To allow
│ this object to be destroyed, update the resource configuration
│ and set "prevent_destroy" to false, then review and apply
│ your changes.

resource "aws_lambda_alias" "prod" {
  name             = "prod"
  function_name    = aws_lambda_function.api.function_name
  function_version = aws_lambda_function.api.version

  # APIゲートウェイのデプロイが完了してからエイリアスを切り替える
  depends_on = [
    aws_api_gateway_deployment.prod,
    aws_api_gateway_stage.prod
  ]
}

# 単体削除（依存関係を事前に確認してから実行）
# terraform destroy -target=aws_instance.old_web

│ Error: Error acquiring the state lock
│
│ Error message: ConditionalCheckFailedException
│ Lock Info:
│   ID:        3da4ab12-1234-5678-abcd-ef0123456789
│   Path:      s3://mybucket/env:/prod/terraform.tfstate
│   Operation: OperationTypeApply
│   Who:       ubuntu@ci-runner-01
│   Created:   2026-10-01 03:45:12.123456789 +0000 UTC

# terraform force-unlock 3da4ab12-1234-5678-abcd-ef0123456789
Do you really want to force-unlock state?
  Terraform will remove the lock on the remote state.
  This will allow local Terraform commands to modify this state, even though it
  may still be in use. Only "yes" will be accepted to confirm.

  Enter a value: yes

Terraform state has been successfully unlocked!

# terraform plan -refresh-only
Note: Objects have changed outside of Terraform

  # aws_security_group.web_sg has been changed
  ~ resource "aws_security_group" "web_sg" {
      ~ ingress {
          - cidr_blocks = ["10.0.0.0/8"]
          + cidr_blocks = ["10.0.0.0/8", "172.16.0.0/12"]
        }
    }

Plan: 0 to add, 0 to change, 0 to destroy.